Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
5c70c3f4d6a10a998cce4e9d58690cc1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c70c3f4d6a10a998cce4e9d58690cc1_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5c70c3f4d6a10a998cce4e9d58690cc1_JaffaCakes118.html
-
Size
26KB
-
MD5
5c70c3f4d6a10a998cce4e9d58690cc1
-
SHA1
f2b083aec2492aadf52ff9873649da19460db701
-
SHA256
fc962abd77c7b81c3f56cf126a615c71823955ee7ae8ef82e7cec6d5a92ef847
-
SHA512
92176402503fa8213fb3472b9fe9dc7b39afc7037cf2271155b67705f66c6ca4b361dfff50c5ff03672fc115776fbf802893fea5dfd3c8542386a31c399e5f5b
-
SSDEEP
384:nqHAM350EXHiL0wkUXuHV4XDZQ/j/NK/HB+uPygcmI4s3jGMl3Njz2Pdqy0Sc:nAZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f2099cc7d1390d72f07a47f33c0aa21f6b1b56fcf5b734db77cab70b0588edb5000000000e8000000002000020000000c555829abba90b057cb5eaf603ca3dacba54c6285001c95bbe24e1bd98dc018190000000390aace07d8a8de70da3df1ddfdd288ccef9ce354e29d63c991a202aad5c3127c4722ca3365859881daae9cb04ec93d71c618da583693d5853925a30681b929fed3da00ddfad69a1fce593e14f49c2980f2f8ee9d709ab470e1dea6dbf844340a1b67b7212f2bad7aeef2420818125d91bf1efcb134810f8d88bfb962e29a21fd327267f936f9199668e25de8dcc616e4000000079b43e2c061b7190e95beb4ac83b6fa1ccb24281621473cf04dcaf95a7dc19c1134be1e01702e8c7e07f2f73805cc818e079202592d52a8d9fccb6ca9408898a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d13c8a53aada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B516F0A1-1646-11EF-9969-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f5e42f597bb973a2f449cb6f401c218ac473d740eb96d20b0fd6f57d652beaa8000000000e8000000002000020000000bc4c7354ca2a75bb0c6b68ceb69981c85a9f3a61e106f1d62feff02bce8f0c6f20000000d1dd8a014605923fba2f2388825f4509949693d0aed23336c601efdb6461053a400000003b295a58662d9cf54eab6a8883a75a878295920b8c74d821a5575bd1c144e05feff59ecd2785c4f8529abbed7c1bfc2c3a155e3e02cf06c8eeefa33b16df5f3d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422329710" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1048 iexplore.exe 1048 iexplore.exe 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE 2944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2944 1048 iexplore.exe 28 PID 1048 wrote to memory of 2944 1048 iexplore.exe 28 PID 1048 wrote to memory of 2944 1048 iexplore.exe 28 PID 1048 wrote to memory of 2944 1048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c70c3f4d6a10a998cce4e9d58690cc1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564ebbeccc1f30e75f3d99fbf54202d4a
SHA1ab72878dfe5a08c46429ca04b409500c3129f1ab
SHA256567f2340fa265dd411ffca94590f0a1abcbbdc7097ab03b756167cc74f90ad32
SHA512b53f980dc25572b88e1cb8bd2d3c2336889ed0bbcae0eee981c3d4281168390b484e7185e18a7fc0630645b8fe9305d0457266347faa3a701773648119d0f905
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f0616bd6c53e8b4dad2038a45ebdd0d
SHA114fa557e702842853134f9b573a7f9d0da3d68b6
SHA2566ea1dbfbc43df9b73d8c8f3dacc5d2373797849e099a765860027c83803fa6fa
SHA512d1ba5fa32ff64e871fefdbf670d53c2a293c745bd284a136991c75569747daf363e1234d2b74dbf4c14d3ba488582019524ef0f8c62f2804c9cbd558a71b7d5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5184c2ab54090278a5a6e95a59e998cfa
SHA1722d3b594fa5fc0f3adc773c19aa1e81cf78c483
SHA25673ca4b8f3d6334ca65a7b218ae647cf6a0f1f5fe225f14e7c0805c7558ea471e
SHA51201976a404e54a93e61ce67cad4098ef90cf0a53f0113b616612d7d84919413556c3dddd234de4fb8b41a5053b8187644f8cd1e70585854035e17bd68fd596a3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daf4af0ee3640b97d47a825b361524c8
SHA126fb28f29d61bd1df3640618d264d6b42de88b2c
SHA256fcfb8e4da187ab3ed3d48d68bee4ee5f3de3c6bc06fbc2b045c52672865a7a12
SHA512ebba77c8fed783b3ec033565aea4ca794e4c5447ae8c2e46793a87626979c2bad38d9905eea14efb597af0529f478151404f90e5a01ec23df8530c86f577fd1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543e7f1522d51a3587f67efc41f8d751d
SHA19262991ca565458fba388e0af0c10499214665f4
SHA256018095fa6f353d166f623f9e1395f5ffac283f6447c96c3185de46cb694aeaa6
SHA51255894c900d9f211c2187d0f64b847b2c201ddbe3a7e8c82bc49aeabb7e858a6fe2a1299de7fb794a4b0e28d89e6669bd7ae7735aba0e2ce366a3c4840b1dbb38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592fe1f602082a9d7f3c50f59c7c91af9
SHA130999c80b907f1216e7fba492129a069e077dd5b
SHA256f1adcfb9184b5406a3fdd294075ec658f4dda74c4ed67f559d1dfb276d5d7a92
SHA512a7f2bc02dd4e74ad5fb92e72ff812f6ce9a973b2079926cf9bbc3af86ca54e21e115330991220cbae010ad35028809bf69e3fd93dc37814fb5fae0d519161dcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca0bac636696dd9f8cd244c2a035673a
SHA16dbc9c0aaa03fd6d2a985ff31e6380b59f136b70
SHA2563fa0e507433909db841cf475b92aae96299b674d5426c55f0a0659d7053bf8b9
SHA512e18275af67acc9db73783b3b6230733c6ed9bd69a6e18910b5c1914df3d67ad56b334b11792a62664f6d27bb16276ba3da3a588084d187883bdb59dd42199584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ac581fd89ceaf16de33dcb74e0e1666
SHA16d98262cf262f3b0defdba3ed8b8b87a45b87c81
SHA2568bcbe986bb1d184fc041324128e397366630316e94673d3763b2bf4164c9f123
SHA512cafe8493d25a0e5b8588bafa77e8f84df5ba6df372cedaa2bf5c83ae574ef2cd50a828b5cbc13d413b1628911c93f1e579668d81bfc22a7529bc7c59541ef4db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf91992dfb2f473addc91badb70a3f2e
SHA1da317c211d8d931ee5540874670f49217f86f929
SHA2566fe410f0fec0a4e38feaf296148a87c3f9c7acf54c14e83846be306937e85646
SHA512e17ae55e4d1b9468d7ce8be46b6dfee3da0a5ca65c351015d9205fcaa5b6da6d1826c7fa6ae589aaaeb90f43828f07cf89fdf01189554711fbdca51fe7661dae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f98835a30c72c83b524fdd2b48493b07
SHA1c93f7dbc0144588e08e6f20abee26cbd0e601900
SHA2564a6331ea5355ec8caf6038dee94bf12a2bcf024234f4d7a195a44981858aa2e5
SHA512226040760abf43011405865b2f999926147f49d88cd3f20b9f46313e4bc49378cee09c1547af540a8847b1f47b963ea05b40eed340c1dd116bb35b776d423049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587176ef792867edf007d884241817ad4
SHA15d09e143770c56ec88ba21ec49c69373f9a586dd
SHA256e132089c46a76ca663f1755fcf8e248d4f6de75fc61b6dd80709107c05ed4de5
SHA5120359e555f00aa7e1068cf749ed294851cf7d4631c107b11953eec39bb34a6f42ac82a839f9bdcac3ca939c8cafb2b2a91d3908b60e23adb81631b1386e8f1ae2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea3c58a61392318aabe170756f412ce9
SHA1f90ac07f800a6371aa4b8baa98fe60165dc579b7
SHA2560939536d065f46ab1b75baeb4298d8b811082a21ca6777a4f2bdb127d855c92c
SHA5121c09b18021c85628f1fe7f677bd92f5d71fd7d339e162a99f877f65e8d73f3bfdde67c9ada12fce6c2f56f8a54e0e4c32b680472ddb334053f6fa4a8cc1970df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b8d72143052d27a4728f6794f0f329b
SHA135c46a635181e4b4cd8f2701608197ee970adfa6
SHA256116bb32672b5f374d451352b5b57c5f0c4c9d933512ec320aed5bca6b5fa5216
SHA5124593d5f2c6e9d789f1384fcec9be6ed75e032661adfa31afbc4744dce7846fffff218fab176feeca56ed2fad24a7414445c1fa125c4f5e78d80d81a7b5da3f99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5012b0e6648f7833ee50a7d558db78fb7
SHA18a23447cceb583e360b9e6f50c9fdc4884e35ba1
SHA2563dc0284a721954995dccb83598a1a754469cf885e622783b74bdb4608390673f
SHA51267a490989f36aa0087d4b42956c83002945c41c977ce0485bec2576bb977aea7ef4f07e28dbd7b98ddad77b8fc35aa0660fbd5f65207a2605863f7572f914d15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cc82667dabbaa2f865ea894163bd9c6
SHA1a3cef11545d72e97284d7308fe02ed45df2f7e87
SHA256721ac556cbf36253bee6b0dd4ea25f4535e79147a6a611cc192836c974c3d839
SHA5124c80df6b2ab60dcc65a3e7bc823439f25927e24473e0b2baf9bc4d9c6be25bd6352db9e694c6f85f45e37ceea3dcb292e09db654e74a0afbe365f6cf7dc56ad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e3da37b067c0f90f5fa1af4bc372469
SHA170a3d83bfc709b81cfc227e0cef9f4a57160577a
SHA25663b52cb443e42dc36b15feb7bd1da016ea7ac3f8174a45c7886aa1abb08afe3d
SHA512714d7d37610978c8493490b48002cced75ca47f1529d1c02d1eb3676fdbb5226c52b2e1d21dfd13d41ade89330306bb3b1c10ed5f6a874f801a9f09b447661e0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a